Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk

Key facts for Interlock education ransomware

Detection coverage for Interlock education ransomware

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5329 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Interlock ClickFix/FileFix Paste-and-Run PowerShell Launched from Explorer

Detects the Interlock ransomware initial-access pattern (CISA AA25-203A, TL-2026-5329). A victim pastes a fake-CAPTCHA command into the Windows Run dialog or File Explorer address bar, so powershell.exe, pwsh.exe or mshta.exe is spawned directly by explorer.exe with a hidden window, encoded command or download cradle. The download_cradle flag marks second-stage retrieval (ingress tool transfer). Maps to T1204.004, T1059.001 and T1105.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.001, T1105
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\mshta.exe") (CommandLine="*-w hidden*" OR CommandLine="*-windowstyle hidden*" OR CommandLine="*-enc *" OR CommandLine="*-encodedcommand*" OR CommandLine="*downloadstring*" OR CommandLine="*invoke-expression*" OR CommandLine="*invoke-webrequest*" OR CommandLine="*invoke-restmethod*" OR CommandLine="*iex *" OR CommandLine="*iex(*" OR CommandLine="*irm *")
| eval download_cradle=if(match(lower(CommandLine),"(downloadstring|downloadfile|invoke-webrequest|invoke-restmethod|\\biwr\\b|\\birm\\b|net\\.webclient)"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen max(download_cradle) as download_cradle values(CommandLine) as detail by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe")
| where ProcessCommandLine has_any ("-w hidden", "-windowstyle hidden", "-enc ", "-encodedcommand", "downloadstring", "invoke-expression", "invoke-webrequest", "invoke-restmethod", "iex ", "iex(", "irm ")
| extend DownloadCradle = ProcessCommandLine has_any ("downloadstring", "downloadfile", "invoke-webrequest", "invoke-restmethod", "irm ", "net.webclient")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DownloadCradle, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: Interlock ClickFix FileFix Paste-and-Run PowerShell Launched from Explorer
id: 3b1f6c52-8a4e-4d17-9c0b-5e2a7d4f1a01
status: experimental
description: Detects PowerShell, pwsh or mshta spawned directly by explorer.exe with hidden-window, encoded-command or download-cradle arguments, the ClickFix and FileFix paste-and-run pattern (fake CAPTCHA pasted into the Run dialog or File Explorer address bar) used by Interlock ransomware for initial access (TL-2026-5329)
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
    - https://blog.talosintelligence.com/emerging-interlock-ransomware/
    - https://www.bleepingcomputer.com/news/security/interlock-ransomware-adopts-filefix-method-to-deliver-malware/
    - https://intel.threadlinqs.com
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_image:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
    selection_cli:
        CommandLine|contains:
            - '-w hidden'
            - '-windowstyle hidden'
            - '-enc '
            - '-encodedcommand'
            - 'downloadstring'
            - 'invoke-expression'
            - 'invoke-webrequest'
            - 'invoke-restmethod'
            - 'iex '
            - 'iex('
            - 'irm '
    condition: selection_parent and selection_image and selection_cli
falsepositives:
    - Administrators or help-desk staff launching hidden or encoded PowerShell from Explorer-driven shortcuts or login scripts
    - Software deployment shortcuts that start PowerShell with -WindowStyle Hidden from the desktop
level: high

Known false positives:

• Administrators or help-desk staff launching hidden or encoded PowerShell from Explorer-driven shortcuts or login scripts
• Software deployment shortcuts that start PowerShell with -WindowStyle Hidden from the desktop

Tuning notes: Exclude known-good signed deployment scripts by command-line hash or path and allowlist admin workstations. Add a prevalence filter (rare command line per host) to cut noise. Prioritise rows where download_cradle=yes. Pair with RunMRU registry monitoring (see KQL-001).

• 🔒 Interlock Fake-CAPTCHA ClickFix Markers in Command Lines and RunMRU · unlock with TL Creds
• 🔒 Interlock Credential Theft: Keylogger [indicator] and Browser Credential Store Access · unlock with TL Creds
• 🔒 Interlock Data Exfiltration Tooling: AzCopy, Azure Storage Explorer and WinSCP to Cloud Storage · unlock with TL Creds
• 🔒 Interlock Kerberoasting: PowerShell Ticket Requests and RC4 Service-Ticket Bursts · unlock with TL Creds
• 🔒 Interlock Ransomware Artifacts: Encrypted Extensions, Ransom Note, [indicator] and [indicator] · unlock with TL Creds
• 🔒 Connection to Community-Reported Cobalt Strike and Interlock-Related Infrastructure · unlock with TL Creds
• 🔒 Interlock '[indicator]' Disguised Logon Run Key Persistence · unlock with TL Creds
• 🔒 Interlock Lateral Movement via Remote Access Tools (AnyDesk, PuTTY) Correlated with RDP Logons · unlock with TL Creds

Indicators of compromise for Interlock education ransomware

As of 2026-11-05, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5329.

How Interlock education ransomware works

Akamai also flags browser-based AI tool data exposure, custom-AI API exposure and agentic AI/RAG pipeline risk.

This record documents sector-level threat activity against education institutions, anchored on an Akamai Security Blog article (Erin Verna, 2026-11-05) that cites three 2026 incidents and does not itself name any ransomware group, malware family or IOC. Attribution and technical detail below come from third-party reporting and are labeled by source.

Community College of Beaver County (CCBC, PA): the college disclosed on 2026-03-09 that attackers encrypted data and disrupted access to grades, transcripts and financial records as it entered spring break; the campus closed and in-person classes resumed 2026-03-30. Interlock, a ransomware operation active since October 2024, later listed CCBC on its leak site claiming 780 GB of data. Comparitech notes the claim is unverified by CCBC and the intrusion method, ransom amount and whether a ransom was paid are unknown.

Instructure Canvas: Instructure reported unauthorized access beginning 2026-04-25, detected on 2026-04-29 and disclosed 2026-05-01. ShinyHunters, an extortion group, was reported to have abused the Free-For-Teacher account program. Reported exposure covers names, email addresses, student IDs and private messages (not passwords, birth dates, government IDs or financial data), with figures of roughly 3.65 TB and ~275 million accounts across ~8,800-9,000 institutions. A second compromise on 2026-05-07 replaced the Canvas login page with a ransom message, and on 2026-05-11 Instructure said it reached an agreement with ShinyHunters and received confirmation of data destruction (unconfirmed press reports cite a ~$10 million payment). This was data-theft extortion rather than file-encrypting ransomware. A class action was filed 2026-05-13 and the House Homeland Security Committee requested a briefing.

Springfield Public Schools (MA): all schools closed from 2026-09-08 after a 'Level 4' cyber incident; the FBI later said student and staff data was breached, possibly including Social Security numbers. On 2026-09-15 Interlock was reported to have claimed the attack (single secondary source; data types claimed include student records, employee data, phone records and medical information).

Interlock TTPs (CISA/FBI joint advisory AA25-203A, July 2025, general to the group and not confirmed for these specific victims): initial access by drive-by download from compromised legitimate sites and ClickFix/FileFix social engineering (fake CAPTCHA, paste-and-run PowerShell); execution of PowerShell, persistence via a disguised 'Chrome Updater' registry run entry, credential theft (Lumma and Berserk stealers, a keylogger klg.dll, Kerberoasting), lateral movement over RDP with AnyDesk and PuTTY, exfiltration through Azure Storage Explorer, AzCopy and WinSCP, Cobalt Strike, SystemBC and NodeSnake/Interlock RATs, and encryption appending .interlock (also .1nt3rlock) with a !__README__!.txt note.

Akamai attributes education exposure to known weaknesses (broken authentication, exposed APIs, phishing, credential theft), decentralized campus networks, and uncontrolled AI tool use (browser-based AI uploads of research data and student records, API data exchange by custom AI apps, agentic AI/RAG pipelines). Stated mitigations: Zero Trust microsegmentation, ZTNA, browser-level DLP for AI use, API security and documented controls for cyber insurance; compliance references are FERPA and OWASP Top 10 (broken access control). No network IOCs (IPs/domains/hashes) were published in any source reviewed, so no BeaconBeagle correlation was possible.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location

Collection

T1056.001 Input Capture: Keylogging

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1204.004 User Execution: Malicious Copy and Paste

Initial Access

T1190 Exploit Public-Facing Application

Command and Control

T1219 Remote Access Tools

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Impact

T1657 Financial Theft

Remediation for Interlock education ransomware

Immediate actions

• Block and alert on ClickFix/FileFix patterns: users pasting commands into the Windows Run dialog or File Explorer address bar that launch PowerShell
• Hunt for the Interlock artifacts conhost.exe/conhost.txt, tmp41.wasd, a 'Chrome Updater' logon run key, and files ending .interlock or .1nt3rlock
• Alert on AzCopy, Azure Storage Explorer and WinSCP use from non-administrative hosts and on unexpected remote access tools (AnyDesk, PuTTY)
• Review Canvas/LMS integrations, free or trial teacher accounts and API tokens; reset exposed credentials and monitor for phishing that reuses leaked names, emails and private messages

Workarounds

• Harden Kerberos service accounts against Kerberoasting (long random passwords, AES-only tickets)
• Restrict outbound access to cloud storage services from endpoints that do not need it

Longer-term hardening

• Deploy Zero Trust microsegmentation to limit lateral movement across decentralized campus networks
• Use ZTNA so users reach only authorized applications
• Apply browser-level DLP to generative AI tool use to prevent uploads of research data and student records
• Secure APIs against broken access control (OWASP Top 10) and govern agentic AI/RAG pipelines and custom LLM integrations
• Maintain offline backups and document security controls required for cyber insurance; align handling of student records with FERPA

Affected and fixed versions

• Community College of Beaver County — Institutional IT systems (PA)
  Vulnerable versions: Not specified
• Instructure — Canvas LMS
  Vulnerable versions: SaaS platform, April-May 2026
  Fixed in: Remediated by vendor per status updates
• Springfield Public Schools — District IT systems (MA)
  Vulnerable versions: Not specified

Timeline of Interlock education ransomware

• 2025-07-22 CISA and FBI publish joint advisory AA25-203A documenting locked-ioc-2 TTPs (drive-by downloads, ClickFix/FileFix, locked-ioc-14 encryption, cloud-storage exfiltration)
• 2026-03-09 Community College of Beaver County (PA) discloses a ransomware attack that encrypted data and disrupted grades, transcripts and financial systems; campus closes
• 2026-03-30 CCBC resumes in-person classes after the closure
• 2026-04-25 Unauthorized actors first access Instructure Canvas systems (reported locked-ioc-10 abuse of the Free-For-Teacher account program)
• 2026-04-29 Instructure detects the intrusion and engages forensic experts
• 2026-05-01 Instructure discloses a data breach affecting names, email addresses, student IDs and private messages
• 2026-05-07 Canvas login page replaced by a ransom message in a second compromise; locked-ioc-10 sets a 2026-05-12 payment deadline
• 2026-05-11 Instructure states it reached an agreement with locked-ioc-10 and received confirmation of data destruction
• 2026-05-13 Class action lawsuit filed in the Southern District of California over the Canvas breach
• 2026-09-08 Springfield Public Schools (MA) closes all schools after a Level 4 cyber incident
• 2026-09-15 FBI says the Springfield incident included a data breach; Interlock is reported to have claimed responsibility
• 2026-11-05 Akamai publishes analysis citing 33% U.S. share of 104 education-sector attacks and AI data-exposure risks

Sources cited for Interlock education ransomware

• Instructure Canvas breach, May 2026 (University of Memphis ITS) memphis.edu · Advisory
• #StopRansomware: Interlock (CISA AA25-203A) CISA · Government advisory · 2025-07-22
• 2026 Canvas data breach (Wikipedia) en.wikipedia.org · Research
• Deconstructing the Canvas (Instructure) Data Breach (JD Supra) jdsupra.com · Research
• Interlock Strikes Springfield Public Schools in Major Ransomware Attack (DeXpose) dexpose.io · Research · 2026-09-15
• Interlock Ransomware Analysis, Simulation, and Mitigation - CISA Alert AA25-203A (Picus Security) picussecurity.com · Research
• Emerging Interlock ransomware (Cisco Talos) Cisco Talos · Vendor report
• Why Higher Ed Needs a New Playbook for Ransomware, AI Risk, and Compliance (Akamai, Erin Verna) akamai.com · Blog · 2026-11-05
• Cybercriminals say they hacked a Pennsylvania community college (Comparitech) comparitech.com · News
• CBS News Pittsburgh: Community College of Beaver County cyberattack cbsnews.com · News
• Springfield, Massachusetts schools cyber attack: student and staff data (WBUR) wbur.org · News · 2026-09-16
• FBI: Springfield school cyber attack included data breach, maybe Social Security numbers (GBH) wgbh.org · News · 2026-09-16
• Interlock ransomware adopts FileFix method to deliver malware (BleepingComputer) BleepingComputer · News

More in ransomware

• The State of Ransomware in Financial Services 2026 (Sophos survey)
• Nova (formerly RALord) Ransomware-as-a-Service Group
• Hawkmoth Anubis Ransomware Attack Uses New Backdoor.Lindnor and BYOVD Security Killers Against U.S. Organization
• NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure
• BlackMatter Ransomware v2.0 — Reverse Engineering Analysis (RSA-1024 / Modified ChaCha20, ICMLuaUtil UAC Bypass)